DF-2871
taskqueue_start_threads() swallows lwkt_create failures and always returns 0 (mirror of DF-2850 in subr_taskqueue.c)
| Field | Value |
|---|---|
| ID | DF-2871 |
| Status | new |
| Severity | Low |
| CVSS 3.1 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H |
| CWE | CWE-754 Improper Check for Exceptional Conditions |
| File | sys/kern/subr_taskqueue.c |
| Lines | 594-606 |
| Area | kern |
| Confidence | certain |
| Discovered | 2026-09-02 |
| Pass | 2 (GLM 5.3 second pass) |
| Bucket | base:kern |
| Reported | pending |
| Known CVE | none |
| CVE match | novel |
Summary
On lwkt_create error the loop kprintf's, NULLs the slot and continues,
then unconditionally return 0. Total failure yields an unrunnable
queue whose enqueues still succeed — every future taskqueue_drain on it
sleeps forever (ta_pending never clears, no waker); partial failure
silently degrades. Same defect class as DF-2850 (gtaskqueue) — this is
the subr_taskqueue.c sibling. Fix: track the error, and on
tq_tcount==0 free tq_threads and return it so callers abort.
Timeline
- 2026-09-02 Discovered during pass-2 audit of subr_taskqueue.c (GLM 5.3).
No comments yet.